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On September 13, the FBI issued 
a public service announcement 
to encourage public awareness 
of cyber threats affecting K-12 
students, specifically those 
heightened by the rapid growth 
of education technologies and 
the widespread collection of 
student data. “Malicious use of 
this sensitive data could result 

in social engineering, bullying, 
tracking, identity theft, or other 
means for targeting children,” 
according to the FBI.' In calling 
for greater awareness of the 
potential misuses of these data, 
the FBI cited breaches in ed tech 
company security and hacked 
school districts. 


State policymakers have long taken the 
threats seriously. State legislatures kept up 
a rapid pace of passing new laws to protect 
student data this year. According to the Data 
Quality Campaign, 42 states were consider- 
ing 300 bills in 2018, and 25 states passed 
59 new laws governing the collection, use, 
access, and protection of education data.? 
In 2017, 42 states introduced 183 bills and 
passed 53 new laws.? 


In 2018, state boards of education 
expressed considerable interest in ac- 
countability for student data protections, 
including adequate training of school staff, 
according to NASBE’s State Board Insight 
data. Yet state boards also recognized the 
paramount importance of making sure that 
families and staff have ready access to 
information to help students. State board 
members in 2018 discussed improved 
transparency of information provided to 
families and staff and facilitating access to 
such information through data dashboards. 


STUDENT DATA PROTECTION 
In September, the Arkansas State Board 
of Education updated Arkansas Depart- 
ment of Education Rules Governing Student 
Permanent Records to remove outdated 
requirements. The changes lay out new re- 
quirements regarding districts’ maintenance 
of student permanent records, specifying 
what information must be maintained (e.g., 
social security number, name, address, 
telephone number) and describing protocols 
for transfer of data when a student moves to 
another district. 


In June, the Maryland State Board of 
Education adopted amendments to state 
regulations on test administration and data 
reporting. Aimed at efficient testing proce- 
dures, the amendments require local school 
systems to deliver accurate, timely assess- 
ment results to parents and guardians. These 
amendments also direct schools to designate 
a local accountability coordinator and a 
school testing coordinator to oversee test 
administration, security, training, and imple- 
mentation of state-mandated assessments. 


In Tennessee, the state board approved an 
update to the policy manual governing state 
board—authorized charter schools in April 
2018. They added two education policies on 
records retention and test security. As part 

of Policy 1408, the director of schools must 
develop a records retention schedule to ensure 
records are maintained in compliance with 
state and federal laws and regulations. This 
schedule ensures charter schools adhere 

to uniform rules regarding data use. Policy 
4701 requires the state board to adopt test 
security procedures that lay out expectations 
for charter schools authorized by the state 
board. These test security procedures include 
training for all personnel involved in testing, 
implementing inventory verification procedures 
for all paper-modified passages, maintaining 


confidentiality of student-specific demographic 
information collected for accountability pur- 
poses and test results, and reporting potential 
breaches of testing security, among other 
detailed processes. 


In October, the Utah State Board of Educa- 
tion approved amendments to Rule 277-487: 
Public School Data Confidentiality and Dis- 
closure, wherein new definitions were added 
for education technology and data terms, and 
changes were made throughout, adding a 
new section on retention of student data.’ This 
section details protocols on classifying stu- 
dent data, making changes, and following and 
creating a retention schedule, which clears up 
confusion on the amount of time that can pass 
before one disposes of student data. 


DATA TRANSPARENCY 

The Every Student Succeeds Act (ESSA) 
requires both state and local districts to 
prepare and widely disseminate annual 
school report cards, which must be devel- 
oped along with parents, concise and easily 
accessible, provided in language that parents 
can understand, and posted annually on 
state and local agency websites.° Based on 
a survey by the Data Quality Campaign, 91 
percent of parents said they would use data 
about school performance to make decisions 
related to their child’s education.® Alongside 
these report cards are also data dashboards, 
which provide information and resources for 
parents, educators, and the community on 
what data are being gathered and for what 
purposes. A majority of states’ ESSA plans 
indicated they will use such a dashboard 

to display information about schoolwide 
performance.’ 


The Michigan State Board of Education 
saw the launch of a new Parent Dashboard 
for School Transparency in January 2018. 
It gives parents and other stakeholders 
access to student-to-staff ratios, school 
attendance, school assessment scores, 
and college-credit or career-tech programs 
when they type in a district, city, or school 
name. It also includes how-to videos on 
finding a student’s school, viewing data, 


sorting by student groups, and using key 
performance indicators.® 


To facilitate better access to education-related 
information, Nebraska transitioned its school 
districts from the Nebraska Student and Staff 
Record System to the Advanced Data Views 
Improving Student Educational Response 
(ADVISER) dashboard, a web-based view 

of student and staff data to help educators 
personalize instruction and make data-driven 
decisions. Some features of ADVISER include 
consolidated, integrated data; daily updates of 
student profiles; organization of students par- 
ticipating in each program; and easy access 
to each student’s contact information as well 
as historical course and assessment perfor- 
mance. It also highlights positive trends and 
flags negative trends and provides an early 
warning system and intervention catalog.° 


The Utah board created a metadata dic- 
tionary, which provides a complete list of col- 
lected student data elements, including how 
data are used, stored, and shared. Anyone 
can search this database using one of two 
categories: data recipients or data elements. 
The data recipients tab lists each outside 
education organization or company that has 
access to student data within a district. By 
Clicking on a name, the user can see which 
data elements the recipient can access and 
why. The data elements tab works the same 
way, but it categorizes recipient names and 
information under elements such as “date of 
birth” or “ACT score.” Though the meta- 
data dictionary does not provide access to 
specific data, it enables parents, guardians, 
and community members to easily find how 
school districts and education organizations 
use student data. This effort helps ensure 
alignment with Utah Senate Bills 102, called 
the Utah Student Privacy Act, and 163, 
Student Information Amendments, which 
confirm that every employee with access to 
educational records must complete train- 
ing on student privacy laws and that no 
third-party contractor can use student data 
for targeted advertising.’° 


CONCLUSION 

According to the National Forum on Educa- 
tion Statistics, state boards of education can 
play an active hand in student data privacy 
and use if they “recommend and adopt 


statewide education policies and provide 
guidance in adhering to privacy laws enacted 
by state legislatures.”"' As the examples of 
state board activity make clear, such actions 
may encompass changing outdated policies, 
creating leadership positions in student data 
protection, enacting efficient data-use rules, 
and creating effective data systems and 
dashboards. 


State boards also look for ways, including 
through the appropriate use of education 
technology, to make sure each student 
receives an excellent education. Good 
practices for student use of technology help 
elevate the educational experiences of all 
students, according to the National Center 
for Education Statistics. Digital learning 
includes student access to online databases 
and the use of student data and information 
to personalize learning." As technology use 
grows and evolves, state boards of education 
will need to keep abreast of the changes 
and ensure that student data privacy and 
data usage practices are continually on their 
agendas and in their discussions. 


Joseph Hedger is NASBE’s associate editor. 
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